??

app-i18n/yaskkserv2: 'cargo audit' reports one or more bundled CRATES as vulnerable

??

app-shells/mcfly: 'cargo audit' reports one or more bundled CRATES as vulnerable

??

app-shells/nushell: 'cargo audit' reports one or more bundled CRATES as vulnerable

??

dev-util/rustup: 'cargo audit' reports one or more bundled CRATES as vulnerable

??

dev-util/wachy: 'cargo audit' reports one or more bundled CRATES as vulnerable

??

dev-vcs/mercurial: 'cargo audit' reports one or more bundled CRATES as vulnerable

??

dev-python/adblock: 'cargo audit' reports one or more bundled CRATES as vulnerable

??

dev-db/{mariadb,mysql,percona-server,mysql-connector-c}: ENABLED_LOCAL_INFILE in the client is exploitable by the server

??

dev-util/bingrep: 'cargo audit' reports one or more bundled CRATES as vulnerable

??

[Tracker] Go x/text DoS via crafted Accept-Language header

CVE-2022-32149

linux kernel: multiple vulnerabilities in Xen
sys-apps/portage uses /var/tmp insecurely
[Tracker] UAF in Expat's xmlparse.c:doContent
[Tracker] Vulnerabilty in app-arch/qpress
[Tracker] Prometheus basic authentication bypass via exporter-toolkit
[Tracker] Denial of service in Go's net/http
[Tracker] Denial of service in Go's crypto/ssh
[Tracker] nuget credential leakage
Use-after-free in Zen 2 processors ("zenbleed")
[Tracker] MySQL DoS (Oracle CPU Oct 2023)
RUSTSEC-2023-0075: unsafe-libyaml: Unaligned write of u64 on 32-bit and 16-bit platforms
GHSA-c827-hfw6-qwvm: rustix: memory explosion leading to potential DOS
[Tracker] runc container breakout vulnerability
[Tracker] CUPS vulnerabilities on 2024-09-26
[Tracker] Vulnerability in 7zip's zstandard (zstd) implementation
dev-libs/xmlrpc-c[-libxml2] uses vulnerable bundle of dev-libs/expat from many years ago
media-libs/giflib buffer overflow
media-libs/giflib path traversal vulnerability in gifinto utility

Major

<app-editors/emacs-{26.3-r19,27.2-r17,28.2-r13,29.3-r3} <app-emacs/org-mode-9.7.5: org-mode command execution vulnerability

CVE-2024-39331

Normal

net-misc/wget: Authorisation header disclosure on redirect (CVE-2021-31879)

CVE-2021-31879

Normal

<dev-lang/R-4.0.4: code execution via malicious CRAN package (CVE-2020-27637)

CVE-2020-27637

Normal

<dev-python/idna-3.7: potential DoS via resource consumption via specially crafted inputs to idna.encode()

CVE-2024-3651

Normal

<kde-apps/konsole-24.12.3-r1, <kde-apps/konsole-25.04.2: Incorrect telnet scheme handling

CVE-2025-49091

Normal

sys-apps/man2html: multiple vulnerabilities

CVE-2021-40647 CVE-2021-40648

Minor

dev-libs/libtomcrypt: Out of bounds read (CVE-2019-17362)

CVE-2019-17362

Minor

sci-libs/hdf5: multiple vulnerabilities

CVE-2020-10809 CVE-2020-10810 CVE-2020-10811 CVE-2020-10812 CVE-2021-45829 CVE-2021-45830 CVE-2021-45832 CVE-2021-45833 CVE-2021-46242 CVE-2021-46243 CVE-2021-46244

sci-libs/hdf5: heap buffer overread

Minor

sci-libs/hdf: Multiple vulnerabilities

CVE-2018-14031 CVE-2018-14032 CVE-2018-14033 CVE-2018-14034 CVE-2018-14035

Minor

dev-libs/keystone: multiple vulnerabilities (CVE-2020-{36404,36405})

CVE-2020-36404 CVE-2020-36405

Normal

[Tracker] HTTP/2 Rapid Reset vulnerability

CVE-2023-44487

Tracked bugs: 7 open / 14 total

??

[Tracker] Vulnerability in gstreamer (CVE-2021-3522)

CVE-2021-3522

Tracked bugs: 1 open / 2 total

??

[Tracker] NO STARTTLS collection of vulnerabilities

Tracked bugs: 2 open / 18 total

??

[Tracker] "KeyTrap" DNS DoS vulnerability

CVE-2023-50387 CVE-2023-50868

Tracked bugs: 4 open / 5 total

??

[TRACKER] kernel: Meltdown and Spectre - A flaw in modern processors (CVE-2017-{5715,5753,5754})

Tracked bugs: 1 open / 7 total

??

[TRACKER] hw: cpu: speculative execution branch target injection (CVE-2017-5715)

CVE-2017-5715

Tracked bugs: 1 open / 11 total

??

[Tracker] Terrapin Vulnerability

CVE-2023-48795

Tracked bugs: 4 open / 10 total

??

[Tracker] Mozilla Foundation Security Advisory for May 14/15th, 2024

CVE-2024-4367 CVE-2024-4767 CVE-2024-4768 CVE-2024-4769 CVE-2024-4770 CVE-2024-4777 MSFA2024-21 MSFA2024-22 MSFA2024-23

Tracked bugs: 263 open / 10000 total

??

[Tracker] Mozilla Foundation Security Advisory for October 29, 2024

CVE-2024-10458 CVE-2024-10459 CVE-2024-10460 CVE-2024-10461 CVE-2024-10462 CVE-2024-10463 CVE-2024-10464 CVE-2024-10465 CVE-2024-10466 CVE-2024-10467 CVE-2024-10468 MFSA2024-55 MFSA2024-56 MFSA2024-57 MFSA2024-58 MFSA2024-59

Tracked bugs: 1 open / 3 total

??

[TRACKER] Vulnerable containers/storage library leads to symlink traversal that can result in denial of service via OOM

CVE-2024-9676

Tracked bugs: 4 open / 4 total

Major

media-libs/libmad: Dos (memory corruption) via crafted MP3 files

CVE-2017-11552

Major

dev-python/reportlab: remote code execution

CVE-2023-33733

Major

app-arch/unzip: null pointer dereference

CVE-2021-4217

Major

app-admin/doas: vulnerable to privilege escalation via TIOCSTI/TIOCLINUX command injection

CVE-2023-28339

Normal

dev-python/pip: Possible code execution via untrusted packages from external indexes (CVE-2018-20225)

CVE-2018-20225

Normal

x11-libs/cairo: NULL pointer dereference with a crafted font file (CVE-2017-7475)

CVE-2017-7475

Normal

media-libs/plib: integer overflow leading to code execution (CVE-2021-38714)

CVE-2021-38714

Normal

sys-devel/flex: Stack exhaustion in mark_beginning_as_normal causing denial of service (CVE-2019-6293)

Normal

dev-embedded/u-boot-tools: unbounded memcpy in nfs

CVE-2022-30767

Normal

sys-devel/patch: invalid free vulnerability

CVE-2021-45261

sys-devel/patch: Double free allowing DoS in another_hunk (CVE-2019-20633)

Normal

app-text/djvu: multiple vulnerabilities (CVE-2021-{3500,32490,32491,32492,32493})

CVE-2021-32490 CVE-2021-32491 CVE-2021-32492 CVE-2021-32493 CVE-2021-3500

Normal

www-misc/awstats: Arbitrary code execution (CVE-2020-35176)

CVE-2020-35176

Normal

dev-db/redis: integer overflow via bundled hiredis

Normal

sys-apps/busybox: multiple vulnerabilities

CVE-2022-28391 CVE-2022-30065

Normal

net-dns/avahi: multiple DoS vulnerabilities

CVE-2021-3468 CVE-2021-3502 CVE-2021-36217 CVE-2023-1981 CVE-2023-38469 CVE-2023-38470 CVE-2023-38471 CVE-2023-38472 CVE-2023-38473

Normal

media-libs/tiff: crafted input results in out-of-memory

CVE-2023-6277

Normal

app-text/htmltidy: arbitrary code execution

CVE-2021-33391

Normal

sys-boot/grub: multiple vulnerabilities

CVE-2025-54770 CVE-2025-54771 CVE-2025-61661 CVE-2025-61662 CVE-2025-61663 CVE-2025-61664

sys-boot/grub: Multiple vulnerabilities

Normal

media-sound/sox: multiple vulnerabilities

CVE-2021-23159 CVE-2021-23172 CVE-2021-23210 CVE-2021-33844 CVE-2021-3643 CVE-2021-40426 CVE-2022-31650 CVE-2022-31651 CVE-2023-26590 CVE-2023-32627 CVE-2023-34318 CVE-2023-34432

Minor

sys-libs/db: Berkeley DB reads DB_CONFIG from the current working directory

CVE-2017-10140

Critical

dev-libs/stb: multiple vulnerabilities

CVE-2023-43281 CVE-2023-43898 CVE-2023-45661 CVE-2023-45662 CVE-2023-45663 CVE-2023-45664 CVE-2023-45666 CVE-2023-45667 CVE-2023-45675 CVE-2023-45676 CVE-2023-45677 CVE-2023-45678 CVE-2023-45679 CVE-2023-45680 CVE-2023-45681 CVE-2023-45682

Critical

net-wireless/wpa_supplicant: possible privilege escalation

CVE-2024-5290

Major

sys-cluster/slurm: Incorrect Authorization

CVE-2024-48936

Major

www-client/firefox{-bin,}: multiple vulnerabilities

CVE-2025-3608

Major

mail-client/thunderbird{-bin,}: multiple vulnerabilities

CVE-2025-2830 CVE-2025-3523

Major

app-containers/containerd: multiple vulnerabilities

CVE-2024-25621 CVE-2025-64329 GHSA-m6hq-p25p-ffr2 GHSA-pwhc-rpq9-4c8w

Major

net-libs/libsoup: multiple vulnerabilities

CVE-2026-1467 CVE-2026-1801 CVE-2026-2369

Normal

net-analyzer/fail2ban: code exection via malicious whois responses (CVE-2021-32749)

CVE-2021-32749

Normal

<sys-devel/gcc-12.1.0: Unicode "bidirectional override" (CVE-2021-42574)

Normal

<dev-lang/python-{3.8.13_p8, 3.9.13_p6, 3.10.6_p4, 3.11.0_rc1_p2}, dev-python/pypy{,3}: Denial of service via abuse of bignum int type

CVE-2020-10735

Minor

<dev-ruby/rails-{7.1.5.2:7.1,7.2.2.2:7.2,8.0.2.1:8.0}: Multiple Vulnerabilities

CVE-2025-24293 CVE-2025-55193

Minor

<net-misc/rsync-3.4.1-r2: Out-of-bounds read

CVE-2025-10158

Minor

<net-libs/gnutls-3.8.12: Multiple vulnerabilities

CVE-2025-14831 CVE-2026-1584

Minor

<app-crypt/p11-kit-0.26.2: Null pointer dereference

CVE-2026-2100

Major

<app-containers/runc-{1.2.8,1.3.3}: Multiple vulnerabilities

CVE-2025-31133 CVE-2025-52565 CVE-2025-52881

Major

<app-crypt/gnupg-{2.4.9, 2.5.14}, <app-crypt/freepg-2.5.16: Memory corruption in armor parser

Normal

<mail-mta/sendmail-8.18.1: smtp smuggling

CVE-2023-51765

Normal

<net-dns/bind-{9.18.42,9.20.16}: multiple vulnerabilities

CVE-2025-40778 CVE-2025-40780 CVE-2025-8677

Normal

<dev-db/redis-8.2.3:0/8.2: Bug in XACKDEL may lead to stack overflow and potential RCE

CVE-2025-62507

Normal

<dev-libs/glib-2.84.4-r1: Multiple vulnerabilities

CVE-2025-13601 CVE-2025-14087

Normal

<dev-lang/php-{8.2.30,8.3.29,8.4.16,8.5.1}: multiple vulnerabilities

CVE-2025-14177 CVE-2025-14178 CVE-2025-14180

Minor

<www-servers/nginx-1.28.1: (CVE-2025-53859) Processing of a specially crafted login/password in ngx_mail_smtp_module might cause worker process memory disclosure

Minor

<net-libs/gnutls-3.8.11: Stack overwrite in gnutls_pkcs11_token_init

CVE-2025-9820 GNUTLS-SA-2025-11-18

Minor

(CVE-2025-11230) <net-misc/haproxy-{2.8.16,3.0.12,3.1.9,3.2.6} / mjson DoS

CVE-2025-11230

Critical

<dev-lang/spidermonkey-128.9.0: multiple vulnerabilities

<dev-lang/spidermonkey-128.4.0: multiple vulnerabilities
<dev-lang/spidermonkey-128.5.0: multiple vulnerabilities
<dev-lang/spidermonkey-128.6.0: multiple vulnerabilities
<dev-lang/spidermonkey-128.8.0: multiple vulnerabilities
<dev-lang/spidermonkey-128.13.0: multiple vulnerabilities

Major

<net-analyzer/cacti-1.2.26: multiple vulnerabilities

CVE-2022-46169 CVE-2023-30534 CVE-2023-31132 CVE-2023-39357 CVE-2023-39358 CVE-2023-39359 CVE-2023-39360 CVE-2023-39361 CVE-2023-39362 CVE-2023-39365 CVE-2023-39510 CVE-2023-39511 CVE-2023-39512 CVE-2023-39513 CVE-2023-39514 CVE-2023-39515 CVE-2023-39516

Major

<dev-lang/orc-0.4.40: Stack-based buffer overflow when formatting error messages for certain input files.

CVE-2024-40897

Major

<dev-lang/spidermonkey-128.4.0: multiple vulnerabilities

<dev-lang/spidermonkey-128.5.0: multiple vulnerabilities
<dev-lang/spidermonkey-128.6.0: multiple vulnerabilities
<dev-lang/spidermonkey-128.8.0: multiple vulnerabilities
<dev-lang/spidermonkey-128.9.0: multiple vulnerabilities
<dev-lang/spidermonkey-128.13.0: multiple vulnerabilities

Major

<sys-process/atop-2.11.1: heap corruption

CVE-2025-31160

Major

<sys-libs/pam-1.7.1: Multiple vulnerabilities

CVE-2024-10963 CVE-2025-6020

Major

<media-libs/openh264-2.6.0: Decoding functions heap overflow

CVE-2025-27091 GHSA-m99q-5j7x-7m9x

Major

<media-libs/libvpx-1.15.2: Use-after-free

Major

<www-client/chromium-134.0.6998.88, <www-client/google-chrome-134.0.6998.88, <www-client/microsoft-edge-134.0.3124.62, <www-client/opera-119.0.5497.12: Multiple vulnerabilities

CVE-2025-1920 CVE-2025-2135 CVE-2025-2136 CVE-2025-2137

<www-client/chromium-139.0.7258.127, <www-client/google-chrome-139.0.7258.127, <www-client/microsoft-edge-139.0.3405.102, <www-client/opera-123.0.5666.0, www-client/vivaldi: multiple vulnerabilities
<www-client/chromium-139.0.7258.138, <www-client/google-chrome-139.0.7258.138, <www-client/microsoft-edge-138.0.3351.144, <www-client/opera-123.0.5666.0, www-client/vivaldi: Out of bounds write in V8
<www-client/chromium-139.0.7258.154, <www-client/google-chrome-139.0.7258.154, <www-client/microsoft-edge-139.0.3405.125, <www-client/opera-123.0.5666.0, www-client/vivaldi: use after free in ANGLE
<www-client/chromium-140.0.7339.185, <www-client/google-chrome-140.0.7339.185, <www-client/microsoft-edge-140.0.3485.81, <www-client/opera-122.0.5643.51, www-client/vivaldi: multiple vulnerabilities
<www-client/chromium-141.0.7390.54, <www-client/google-chrome-141.0.7390.54, <www-client/microsoft-edge-141.0.3537.57, <www-client/opera-125.0.5729.12, www-client/vivaldi: multiple vulnerabilities
<www-client/chromium-141.0.7390.107, <www-client/google-chrome-141.0.7390.107, <www-client/microsoft-edge-141.0.3537.85, <www-client/opera-125.0.5729.12, www-client/vivaldi: Use after free in Safe Browsing

Major

<dev-lang/python-{3.9.21_p1:3.9,3.10.16_p1:3.10,3.11.11_p1:3.11,3.12.8:3.12,3.13.1:3.13,3.13.1_p1-r100:3.13t,3.14.0_alpha2:3.14,3.14.0_alpha2-r100:3.14t}: Virtual environment (venv) activation scripts don't quote paths

CVE-2024-9287

Major

<mail-client/thunderbird{-bin,}-128.13.0: multiple vulnerabilities

mail-client/thunderbird: august 2025 vulnerabilities, <142.0 & <140.2.0 & <128.14.0
mail-client/thunderbird: <144.0 & <140.4.0 October 2025 vulnerabilities
<mail-client/thunderbird{-bin,}-{140.7.0,147.0}: multiple vulnerabilities

960565, 961886, 964432, 968812

Major

<www-client/firefox{-bin,}-{128.13.0,140.1.0,141.0}: multiple vulnerabilities

www-client/firefox: <142.0 & <140.2.0 & <128.14.0 august 2025 vulnerabilities
www-client/firefox: <143.0 & <140.3.0 september 2025 vulnerabilities
www-client/firefox: <144.0 & <140.4.0 October 2025 vulnerabilities
www-client/firefox: <145.0 & <140.5.0 November 2025 vulnerabilities
<www-client/firefox{-bin,}-{140.7.0,147.0}: multiple vulnerabilities

960564, 961884, 962992, 964338, 966044, 968771

Major

www-client/firefox: <142.0 & <140.2.0 & <128.14.0 august 2025 vulnerabilities

<www-client/firefox{-bin,}-{128.13.0,140.1.0,141.0}: multiple vulnerabilities
www-client/firefox: <144.0 & <140.4.0 October 2025 vulnerabilities
www-client/firefox: <145.0 & <140.5.0 November 2025 vulnerabilities
<www-client/firefox{-bin,}-{140.7.0,147.0}: multiple vulnerabilities

961884, 960564, 964338, 966044, 968771

Major

mail-client/thunderbird: august 2025 vulnerabilities, <142.0 & <140.2.0 & <128.14.0

<mail-client/thunderbird{-bin,}-128.13.0: multiple vulnerabilities
mail-client/thunderbird: <144.0 & <140.4.0 October 2025 vulnerabilities
<mail-client/thunderbird{-bin,}-{140.7.0,147.0}: multiple vulnerabilities

961886, 960565, 964432, 968812

Major

www-client/firefox: <143.0 & <140.3.0 september 2025 vulnerabilities

<www-client/firefox{-bin,}-{128.13.0,140.1.0,141.0}: multiple vulnerabilities
www-client/firefox: <144.0 & <140.4.0 October 2025 vulnerabilities
www-client/firefox: <145.0 & <140.5.0 November 2025 vulnerabilities
<www-client/firefox{-bin,}-{140.7.0,147.0}: multiple vulnerabilities

962992, 960564, 964338, 966044, 968771

Major

<dev-lang/python-{3.9.21_p1:3.9,3.10.16_p1:3.10,3.11.11_p1:3.11,3.12.8:3.12,3.13.1:3.13,3.13.1_p1-r100:3.13t,3.14.0_alpha2:3.14,3.14.0_alpha2-r100:3.14t}: Virtual environment (venv) activation scripts don't quote paths

CVE-2024-9287

<dev-lang/python-{0.3.13.5_p1,0.3.14.0_rc1_p1,3.9.23_p2,3.10.18_p2,3.11.13_p1,3.12.11_p1,3.13.5_p1,3.14.0_rc1_p1}, <dev-lang/pypy-3.11.7.3.20_p2: HTMLParser quadratic complexity when processing malformed inputs (and more HTMLParser vulnerabilities)
<dev-lang/python-{0.3.13.5_p1,0.3.14.0_rc1_p1,3.9.23_p2,3.10.18_p2,3.11.13_p1,3.12.11_p1,3.13.5_p1,3.14.0_rc1_p1}, <dev-lang/pypy-3.11.7.3.20_p2: Tarfile infinite loop during parsing with negative member offset

942077, 958449, 960868

Major

www-client/firefox: <144.0 & <140.4.0 October 2025 vulnerabilities

<www-client/firefox{-bin,}-{128.13.0,140.1.0,141.0}: multiple vulnerabilities
www-client/firefox: <142.0 & <140.2.0 & <128.14.0 august 2025 vulnerabilities
www-client/firefox: <143.0 & <140.3.0 september 2025 vulnerabilities
<www-client/firefox{-bin,}-{140.7.0,147.0}: multiple vulnerabilities

964338, 960564, 961884, 962992, 968771

Major

mail-client/thunderbird: <144.0 & <140.4.0 October 2025 vulnerabilities

<mail-client/thunderbird{-bin,}-128.13.0: multiple vulnerabilities
mail-client/thunderbird: august 2025 vulnerabilities, <142.0 & <140.2.0 & <128.14.0
<mail-client/thunderbird{-bin,}-{140.7.0,147.0}: multiple vulnerabilities

964432, 960565, 961886, 968812

Major

www-client/firefox: <145.0 & <140.5.0 November 2025 vulnerabilities

<www-client/firefox{-bin,}-{128.13.0,140.1.0,141.0}: multiple vulnerabilities
www-client/firefox: <142.0 & <140.2.0 & <128.14.0 august 2025 vulnerabilities
www-client/firefox: <143.0 & <140.3.0 september 2025 vulnerabilities
<www-client/firefox{-bin,}-{140.7.0,147.0}: multiple vulnerabilities

966044, 960564, 961884, 962992, 968771

Major

<app-containers/podman-5.7.0: runc container escape and denial of service due to arbitrary write gadgets and procfs write redirects

<app-containers/podman-5.0.3: unexpected authenticated registry access
<app-containers/podman-5.2.4: improper input validation
<app-containers/podman-5.2.5: symlink traversal can result in denial of service via OOM

965982, 936573, 941217, 942556